Add Telegram webhook support with credential injection

Enable instant message delivery for Telegram via webhooks instead of polling.

Key changes:
- Add tunnel URL configuration for local development (ngrok, cloudflare)
- Auto-register webhook with Telegram API on startup using setWebhook
- Implement webhook secret validation via X-Telegram-Bot-Api-Secret-Token header
- Add credential injection for bot token via URL placeholder substitution
- Fix metadata preservation in respond() to route replies correctly
- Fix serde flatten with Option<T> issue in capabilities schema parsing

The credential injection pattern replaces {TELEGRAM_BOT_TOKEN} placeholders
in URLs with the actual token from the secrets store, keeping credentials
out of WASM module memory until the HTTP request is made.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/settings.rs

@@ -17,11 +17,25 @@ pub struct Settings {
     #[serde(default)]
     pub setup_completed: bool,
 
+    /// Tunnel configuration for exposing the agent to the internet.
+    #[serde(default)]
+    pub tunnel: TunnelSettings,
+
     /// Channel configuration.
     #[serde(default)]
     pub channels: ChannelSettings,
 }
 
+/// Tunnel settings for public webhook endpoints.
+///
+/// The tunnel URL is shared across all channels that need webhooks.
+#[derive(Debug, Clone, Serialize, Deserialize, Default)]
+pub struct TunnelSettings {
+    /// Public URL from tunnel provider (e.g., "https://abc123.ngrok.io").
+    #[serde(default)]
+    pub public_url: Option<String>,
+}
+
 /// Channel-specific settings.
 #[derive(Debug, Clone, Serialize, Deserialize, Default)]
 pub struct ChannelSettings {